Seoul St. Mary's Hospital becomes first in Korea to earn ISMS certification covering PACS

The Catholic University of Korea Seoul St. Mary's Hospital announced Thursday that it has become the first medical institution in South Korea to obtain Information Security Management System (ISMS) certification covering its Picture Archiving and Communication System (PACS). The certification runs for three years, from July 1, 2026, to June 30, 2029.

The certification represents a proactive expansion of managed systems amid a growing number of security incidents, and comes as the industry braces for digital healthcare legislation. Industry observers say it sets a direction other medical institutions should follow.

The hospital's radiology team led the certification effort, with the information security team handling day-to-day operations. Security consulting firm Haengbok Soft and PACS manufacturer Taeyoung Soft also participated.

Haengbok Soft handled security consulting across the entire certification process, covering: PACS certification scope definition, organizational setup and information asset identification, status and workflow analysis, vulnerability assessment, account management and access control review, risk evaluation and protective measures, and encryption and access log management.

Taeyoung Soft, the vendor responsible for PACS supply and maintenance, took part directly in the on-site review and actively supported detailed security measures.

PACS processes vast volumes of imaging data from CT scanners, MRI machines and other medical equipment installed throughout the hospital, exchanging information in real time with the electronic medical record (EMR) system at the core of patient care.

PACS operates under an inherently open structure that requires constant access by a wide range of external parties — including health information exchange programs, outside consultation and interpretation services, and remote connections for equipment maintenance. Experts have long noted a structural vulnerability in that these access points cannot simply be blocked at the source.

With this certification, Seoul St. Mary's Hospital has brought not only EMR but also the creation, storage and transmission of medical images — along with external access and vendor maintenance procedures — under its information security framework. The certification stands apart from existing ISMS certifications at other medical institutions because it establishes a supply chain security framework extending beyond internal hospital systems to encompass PACS manufacturers and maintenance vendors.

The hospital plans to use this certification as a starting point for continuously strengthening its supply chain security management, amid the broader challenge facing medical institutions to enhance information protection.

It is also pursuing ISO international certification to bring its safety standards to a world-class level, while expanding a multi-network separation framework aligned with the National Intelligence Service's hospital information system security guidelines.

A multi-network project that strictly separates computer networks used for administrative work, internet access, research and medical devices — designed with the rapid growth of AI and cloud-based medical devices in mind — is expected to create a safer operating environment for medical equipment while accelerating linkage with domestic medical device security certification.

Lee In-suk, head of the radiology team that led the project, said the standard DICOM file format for medical imaging contains a wide range of patient information, and that there have been multiple PACS breach cases in South Korea. "It can no longer remain a blind spot in security," she said. "As AI advances and more digital medical devices are introduced, we concluded that supply chain security management needs far greater attention."

Kim Seon-tae, head of the information security team who oversaw the certification process, said the achievement goes beyond simply obtaining a credential. "What makes this significant is that it is the first case in which security blind spots for medical devices scattered throughout the hospital have been brought inside the information security management framework," he said.

Hospital director Lee Ji-yeol said the security level of systems constantly linked to EMR determines the overall reliability of the hospital's information protection framework. "We will continue to inspect and strengthen security across the entire hospital," he said. "Patient safety and information protection are not separate matters — we will keep investing and managing them as a single dimension of care quality."

Meanwhile, in November last year, Seoul St. Mary's Hospital took first place in South Korea at the "2025 Medical Information Protection Challenge," hosted by the Ministry of Health and Welfare and organized by the Korea Social Security Information Service and the Medical Information Protection Center, as part of its proactive efforts to stay ahead of the surge in security breaches.